Executive brief
A vulnerability exists in gdk-pixbuf, a widely used library for loading and manipulating images on Linux systems. By providing a specially crafted icon (ICO) file, an attacker can cause the system to leak sensitive information from its memory. This information is converted into image pixels, which could allow an attacker to see private data by viewing a generated thumbnail or processed version of the malicious image.
Technical details
An out-of-bounds read vulnerability exists in the ICO image parser of gdk-pixbuf within the io-ico.c component. The functions OneLine8(), OneLine4(), and OneLine1() fail to validate pixel values against the actual palette size (biClrUsed) before using them as indices to access the palette buffer. An attacker can provide a crafted ICO file where pixel values exceed the palette range, causing the library to read adjacent heap memory. These leaked heap bytes are then rendered as RGB values in the resulting image output, allowing for remote information disclosure if an attacker can retrieve the processed image or its thumbnail.
Affected products
- Red Hat gdk-pixbuf2 6, 7, 8, 9, 10
- GNOME gdk-pixbuf All versions
Timeline
- 2026-07-23: disclosed: Initial report in GNOME GitLab and Red Hat Bugzilla
- 2026-07-23: advisory: NVD published CVE-2026-16768